Black October: AI Security's New Normal

On 22 October, Anthropic's deputy chief information security officer, Jason Clinton, looked back at the previous four days and warned that things "are going to get a lot worse before they get better" (Business Today). His advice to security leaders was to take the crisis to their boards and ask for help now, not for AI but for the basics, and to plan on holding on for about 18 months.

Those four days were quite something. PHP, the language behind most of the web, needed an emergency fix for flaws found with AI. Node.js fixed a bug found by an AI security tool. An Indian certificate authority turned out to have signing keys anyone could calculate. A popular AI developer tool shipped a poisoned release, a WordPress plugin vendor's own update channel was turned against its users, two cloud platforms said intruders may have read their customers' secrets, and governments across Europe switched off their own websites to patch. People started calling it Black October (Wikipedia).

None of this came out of nowhere. In August Clinton had warned of a coming "vulnerability tsunami" (OfficeChai). In April his chief executive, Dario Amodei, called cyber "the first clear and present danger from frontier AI models", and in May he put a deadline on it: roughly six to twelve months to patch what AI had already found before Chinese AI models caught up (CNBC). In the middle of the PHP fallout, Chainguard's chief executive Dan Lorenc put it in words much of the industry now echoes: "I think this is kind of the new normal" (The Register).

In September I wrote that what AI changed about attacks was the clock, not the tools. October showed the clock speeding up everywhere at once: in finding bugs, in exploiting them, in the supply chains that deliver software, and in the platforms that hold everyone's keys. Below: what went wrong, the pattern underneath it, why Clinton thinks it gets worse first, and what to do about it, first if you are a person with a phone and some accounts, then if you run a business.

Black October, in one table#

Our weekly roundups for week 42 and week 43 cover many of these in detail. What follows is about what they add up to.

Not one bug: five things broke at once#

1) The software everything is built on#

PHP2Shell is two memory-safety flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on a web server without logging in. PHP runs roughly seven in ten websites, and the vulnerable code goes back to PHP 5.4 from 2012. Researchers at Calif, OpenAI and Wiz found the flaws in August, with OpenAI's GPT-5.6 Sol model playing a key part (Fortune). The details leaked before the fix shipped, and government sites in France, Finland, Denmark and the Netherlands, Australia's own national cyber security agency and the Port of Rotterdam went offline to patch (iTWire). Cloudflare saw attempts climb from thousands before the announcement to millions by the next morning (The Next Web). On 26 October CISA confirmed active exploitation and gave US federal agencies three days to patch (The Hacker News). Our PHP2Shell guide covers who is exposed and how to fix it.

Node2Shell is CVE-2026-111497, an out-of-bounds write in the Brotli decompressor that Node.js bundles, which the Node.js advisory credits to OpenAI's Codex Security (Brandefense). Ordinary code reaches it through fetch() and Express 5's body parsing, and because the bug sits in Google's Brotli library, Bun, Envoy, Istio and Python's Brotli package needed fixes too. When we wrote our Node.js post nobody had reported attacks. On 27 October CISA added it to its exploited list, after a threat intelligence firm recorded a correctly built exploit for Node.js 24.22.0, the kind of traffic that suggests tooling made for mass use (The Hacker News).

They were not alone. The same week GitLab fixed a maximum-severity 10.0 flaw in the regular-expression engine it ships, affecting every self-managed release since 2014 and the fourth critical bug traced to that engine since September (The Hacker News). Two critical flaws in the Linux kernel's built-in file-sharing server, found by an AI vulnerability scanner, were published on public mailing lists before any fix existed (The Hacker News).

And the old code is inside the boxes meant to protect you. Many firewalls, VPN gateways and storage devices run PHP in their management interfaces, and within days Palo Alto Networks, F5, NetScaler, Check Point and QNAP confirmed affected products. Their customers cannot update PHP themselves; they wait for the vendor's firmware (BleepingComputer).

2) The channels that deliver updates#

The second pattern was attackers going after the things you are told to trust and update automatically.

• Rank Math PRO, a popular WordPress SEO plugin, served a backdoored release through its own update system for about 11 hours (The Hacker News).
• UpdraftCentral, the remote management service for the UpdraftPlus backup plugin, had connection keys stolen from the vendor's website and used to install backdoor plugins on connected sites; Patchstack counted 99 different backdoor names in 18 hours (The Hacker News).
• OVHcloud's command-line tool had five past releases swapped for credential stealers for 94 minutes through a hijacked contributor account. Homebrew users were protected because Homebrew had pinned the original file hashes (The Hacker News).
• LiteLLM, a widely used gateway for calling AI models, published a release that stole cloud tokens, SSH keys and AI credentials the moment Python started (The Hacker News). The way in was a master key committed to a public repository in May, flagged for revocation, and never actually revoked (The Hacker News).

3) The platforms that hold everyone's keys#

The third was the platforms where developers and businesses keep their secrets.

• Railway, an app hosting platform, said an intruder may have read, and in some cases decrypted, the stored secrets of up to 1.85% of workspaces; one researcher reported crypto wallets drained where private keys were kept there (The Hacker News).
• Zeabur lost data from 321,810 accounts and 3.2 million stored configuration records in its second breach in two months, carried out with administrator credentials that had stayed active after the first. It is shutting down by 31 December (Cybernews).
• GMO Internet found malware on customer machines in its Onamae Desktop Cloud service and shut down up to 26,739 servers, a service widely used to run automated currency-trading tools (BleepingComputer). It later said trading account logins stored on those servers may have been taken and misused (Hakky).
• Keystone, a hardware wallet maker, said a breach of its website exposed the key its devices use to prove they are genuine. It will destroy 18,835 unsold devices (The Hacker News).
• Anthropic itself was reached by Cathedral, a months-old startup testing under Anthropic's bug bounty programme, whose AI agents got into sales, HR and IT systems through third-party business software. Anthropic says user conversations, source code and model weights were never reached, and disputes how quickly it happened (The Decoder).

4) The trust anchors#

Certificate authorities are the companies your browser trusts to vouch that a website is who it claims to be. Eight of eMudhra's signing keys turned out to be so weak, each one a number below 256, that anyone could calculate them almost instantly. Browsers blocked them within hours, nobody has shown misuse, and eMudhra has decided to leave the global website certificate business (The Hacker News). No AI was involved here at all, which is a useful reminder: the old failure modes did not go away while everyone was looking at the new ones.

5) Attackers handing the work to machines#

The fifth was the clearest picture yet of AI doing the attacking.

• Japan has been under a wave of breaches since late September, hitting JR East, Lawson, Times Car and more than 20 companies in all, including through a ransomware attack on SoftBank's cloud unit that stopped servers for 495 customers (Sovereign Magazine). The head of the ruling party's cybersecurity headquarters called it "a state of emergency in cyber space". Japan's national CERT found the attackers used AI tools to scan for known vulnerabilities and attack through APIs (ITPro), though experts told The Japan Times there is no firm evidence AI guided the campaign (The Next Web).
• A Chinese-speaking operator gave autonomous agents goals such as running code on a shop's website and planting a web shell, and reached the websites of more than 100 companies, at roughly $50 of AI usage per successful hack (The Hacker News).
• Ransomware affiliates had commercial AI models carry out intrusions step by step against about 62 organisations, with a human approving each step and rewording refused requests as authorised red-team tests (The Hacker News).
• And at the edge, the Qilin and INC ransomware groups used a months-old Palo Alto flaw to open VPN sessions past multi-factor authentication (The Hacker News), while an access broker called "k0t" collected more than 70,000 credentials from firewalls broken into through known flaws or common passwords (The Hacker News).

The pattern underneath#

Line the incidents up and three things repeat.

• Old, trusted code that everyone uses. A language from 1995 with flaws dating to 2012, a code server whose flaw reaches back to 2014, a compression library bundled into a long list of other software. Nobody audits what everybody already trusts.
• Keys that were weak, leaked or never retired. LiteLLM's key from May, Zeabur's administrator credentials from August, UpdraftCentral's connection keys, eMudhra's guessable signing keys. An uncomfortable number of October's breaches were secrets that should already have been dead.
• One supplier, thousands of victims. A plugin vendor, a cloud platform, a command-line tool, a certificate authority, a hosting provider. Compromise one, and you reach everyone downstream of it.

AI sped up the first and gave attackers cheaper labour for all three. It created neither the second nor the third. Those are basic hygiene, which is exactly what Clinton asked boards to fund.

It is also worth knowing that October was a surge in disclosures as much as in attacks. Several of the incidents that landed this month had begun weeks or months earlier (SecurityToday); the Adobe Commerce campaign CISA flagged on 27 October has been running since at least July 2025. Some of what felt like a sudden storm was the backlog becoming visible.

What actually changed#

None of the October bugs was a new kind of bug. Memory corruption in C code, a parser that trusts malformed input, a stolen key, a backdoored update: all of that is decades old. What changed is the economics around them, in four places.

1) Finding serious bugs got cheap#

The scale comes first. Anthropic says partners in its Project Glasswing programme found at least 129,000 verified vulnerabilities between April and July, more than 33,000 of them critical or high, and that it expects the real figure to be at least five times higher (Anthropic).

The targets come second. PHP is one of the most studied codebases on the internet, and these bugs survived 14 years of that attention. Once one team found them, others followed fast: after Chainguard heard that something was coming in PHP, its team used AI to independently find the same flaws, starting, Lorenc says, from a basic prompt asking for serious PHP vulnerabilities (Computing). On the eve of the release, the researcher Brendan Dolan-Gavitt joked that everyone pointing their models at PHP that night might find dozens of other critical bugs (Techmeme). Two days later PHP disclosed a further, lower-risk way to run code on servers that the emergency release did not fix (Escudo Digital).

The third is who is doing it. Amodei's warning was framed around Anthropic's Mythos, but both of October's headline bugs were found with help from OpenAI's models. That is the proliferation he described: the capability is no longer one lab's secret, and restricting access only works while every capable model is restricted.

2) Exploits arrive in hours, sometimes before the fix#

Researchers at the security firm Tolmo built a working PHP2Shell exploit in under a day, and told CNBC the same job would have taken "multiple weeks" before current AI models (CNBC). Microsoft's 2026 Digital Defense Report puts the median time from a vulnerability's discovery to a working weapon at under 24 hours (Metir), and says exploitation of public-facing applications grew from 15% of the incidents it handled in 2025 to 24% in 2026 (Infosecurity Magazine).

The quality curve moved just as fast. On release day the PHP Foundation said the public exploits it had seen were broken, AI-generated code. Three days later Trail of Bits said its exploit worked against stock production settings, with memory protections on and under load, on WordPress, MediaWiki, phpBB and Laravel (Trail of Bits). Judging a bug by how bad the first day's public exploits look is now a mistake.

And sometimes the clock starts before you hear anything at all. Amazon's first PHP2Shell sighting was on 17 October, four days before the fix existed (The Next Web). Days after Oracle patched a critical E-Business Suite flaw, decoy servers were already recording attempts against it (The Hacker News).

3) Fixing is now the bottleneck#

Discovery scales with compute. Fixing scales with people, and in open source those people are often volunteers. Anthropic said as much in its first Glasswing update, calling the low number of patches a genuine problem and admitting that even its own slow pace of disclosure was "adding to an already-overloaded security ecosystem" (Anthropic). Microsoft's report reaches the same conclusion from the other side: AI-powered discovery is outrunning defenders' ability to remediate (BleepingComputer).

You can feel it in two places. One is volume. Microsoft's monthly release went from 206 fixes in June to 622 in July and 1,411 in October, and September's update, smaller than October's, broke booting, VPNs and backups on some machines and needed an emergency follow-up (Pasquale Pillitteri). The other is the tail. PHP 8.1 and older got no official fix for PHP2Shell, nor did Node.js 20, which reached end of life in April (Konfirmity). Appliances wait on their vendors. Every old version still running is a pile of bugs that AI can find and nobody will fix.

4) Secrets don't hold#

The PHP2Shell disclosure broke at three points: an anonymous post leaked the CVE numbers, Calif accidentally published a video of its exploit, and Chainguard released fixed container images hours before the agreed time. A columnist at The Register summed it up: the bug was "too tasty a treat to keep secret" (The Register).

You can argue about who was at fault. The structural point is simpler. A coordinated disclosure only works while nobody else can find the bug. If another team can rediscover it in an evening from a one-line prompt, the embargo lasts exactly as long as nobody else looks, and the warning you get before a fix lands will keep getting shorter.

Why it gets worse before it gets better#

Clinton's 18 months is a specific claim, and the reasons behind it hold up.

• The backlog is huge, and most of it is unpatched. Glasswing's 129,000 verified bugs are an undercount by Anthropic's own estimate, maintainers are fixing a fraction of them, and Microsoft said in May that its patch releases would keep growing for some time (Engadget). Each of those fixes is also a map for attackers.
• The tail can't be patched quickly. End-of-life PHP and Node, firewalls waiting on firmware, and home routers: a Broadcom Wi-Fi flaw disclosed this month affects routers from dozens of vendors, and older chips have no usable fix at all (The Hacker News).
• Disclosure lags attack. Breach notices trail intrusions by weeks or months. Investigations into October's incidents will produce more notices well into next year, as Japan's slow drip of corporate disclosures has shown.
• The capability keeps spreading. Today the strongest bug-finding models sit behind access programmes. Open-source AI attack frameworks such as CyberStrikeAI are already in criminal use (SC Media), and openly downloadable models are closing the gap.

What "better" looks like is just as specific. Clinton argues the lasting fix is cheap, small models that stop software from shipping security bugs in the first place (WION). Amodei's own April thread made the same case at a larger scale: done right, this could leave us with "a fundamentally more secure internet" than before. The 18 months is the gap between AI finding old bugs and AI preventing new ones.

How worried should you be?#

There is a real case for calm, and it is worth stating properly.

• Defenders found the headline bugs first. OpenAI's Patch the Planet programme gave critical infrastructure providers more than two months before PHP2Shell went public. Transformer's newsletter called this, roughly, the system working as intended, while warning that weeks of websites vanishing to patch may become routine (Transformer).
• The panic cost more than the attacks, at first. The outages were precautionary, and ColorTokens noted while the patching was still going on that the shutdowns were doing more damage than any confirmed exploitation (ColorTokens). Palo Alto Networks' Unit 42 retracted an early claim that a European government agency was breached through PHP2Shell (The Hacker News). That is changing now that CISA has confirmed exploitation, but most of what has been seen so far is opportunistic.
• The imbalance is probably temporary. Microsoft expects attackers' early advantage to even out as defenders adopt the same tools, and its report opens with the line "AI is changing the physics of cybersecurity" rather than declaring the fight lost (Metir).
• Not everyone accepts the framing. Yann LeCun told Fortune that the recent string of rogue AI incidents came down to poor human oversight and system design, and was preventable (Fortune). It is also fair to notice that AI labs warning about AI cyber risk are selling AI cyber defence.

My view is that both things are true. Look at the list again: a key nobody revoked, credentials nobody rotated, a weak key from a botched ceremony, a firewall with a guessable password, software past end of life. AI does not invent a new category of risk for most organisations. What it removes is the slack they were quietly relying on, and that slack is what the 30-day patch cycle, the annual penetration test and "nobody would bother with us" were made of.

What it means for you personally#

You can't patch PHP, and you don't run Railway. Most of this month landed on servers and platforms you don't own. It still reaches you, in four ways.

1) Your data lives on the servers that are behind#

The websites, shops and apps you use run on the software that just had its worst month in years, and not all of them will patch quickly. Expect more breach notifications over the coming months. You can't stop a shop being breached, but you can limit what that breach does to you:

• Use a unique password for every site, kept in a password manager. A breached shop then costs you one account, not ten. When a service tells you to change a password, change it anywhere you reused it too. Our password and passkey guide covers the setup.
• Switch to passkeys wherever they are offered. A site holding your passkey stores only a public key, so a breach of that site leaks nothing an attacker can log in with, and passkeys can't be phished. Authenticator-app codes are a decent fallback but can be phished; avoid text-message codes where a better option exists.
• Keep less data in fewer places. Close accounts you no longer use, don't save your card on sites you visit once a year, and don't leave passwords for banks or trading accounts on a rented server or remote desktop. That is exactly what was taken from GMO's customers.

2) Updates are now urgent, not optional#

The same clock applies to your devices. When the gap between a fix and an attack is measured in hours, "remind me next week" is the wrong answer.

• Turn on automatic updates for your phone, computer, browser and apps, and restart when asked. Browsers in particular only apply updates on restart.
• Check the boxes nobody thinks about. Your router, NAS, cameras, media server and smart-home hubs are small servers in your home. Check whether the manufacturer still ships updates, and replace anything that has stopped getting them. If your internet provider gave you an older cable gateway, ask them whether the Broadcom Wi-Fi flaw affects it. Our post on the EU Cyber Resilience Act explains why new devices will soon have to tell you when support ends.
• Get off old versions. If your PC runs Windows 11 version 24H2 in the Home or Pro edition, October was its last security update (PCWorld); install the newer version Windows Update offers.

3) The scams are getting better too#

The same models that find bugs also write convincing messages and clone voices. One in four Americans received a deepfake voice call in the past year, according to a survey of more than 12,000 people in six countries by the call-protection company Hiya (Hiya), and the FBI says AI-related scams cost Americans nearly $900 million in 2025 (Malwarebytes).

• Agree a family code word for emergency calls. If a voice that sounds like your child asks for money, ask for the word, or hang up and call back on the number you already have.
• Treat urgency as the warning sign, not bad grammar. AI writes clean text in any language. The tell is pressure: act now, don't tell anyone, pay this way. Our smishing guide walks through the pattern.
• Never paste a command a website asks you to run. Fake CAPTCHA pages that tell you to press Win+R and paste something are now sold as a service, and Microsoft counted such commands run on more than 1.1 million devices in three months (Metir). Our explainer shows what they look like.

4) Security news is bait#

Every big incident brings a wave of phishing built on it: "your account was affected by a critical vulnerability, verify here", fake patch tools, fake exploit code that infects whoever runs it. GMO warned its own customers to expect exactly that (Daily Security Review). Get updates only from your device's own update settings or the vendor's own site, never from a link in an email. Buy security hardware such as wallets and keys directly from the manufacturer, and if the maker reports a breach, follow its guidance before trusting the device again. And when a site you use shows a maintenance page in a week like this one, it is most likely patching. Don't go hunting for a mirror or an "alternative login".

What it means for businesses#

The rules haven't changed. The deadlines have. None of the following is new advice, and all of it now has to work in hours rather than weeks.

1) Take Clinton's advice literally#

Go to your board now, while Black October is in the news, and ask for budget for the basics: an accurate asset inventory, faster patching, phishing-resistant sign-in, secrets management, tested backups and network segmentation. Not an AI security platform. The incidents above were not stopped by anything exotic, and most of them would have been stopped by things on that list.

2) Know where you run everything#

When an emergency fix lands, the first question is "where do we run this?", and most organisations take days to answer it. One expert quoted by Computer Weekly put the Log4j lesson well: treat how quickly you can find where you run something as a capability you measure, separate from how fast you patch (Computer Weekly).

• Include what's bundled. Node2Shell lived in a compression library that also shipped inside Bun, Envoy, Istio and Python packages. PHP hides in firewalls, VPN gateways, storage appliances and vendor software. A software bill of materials for what you build, and a list of what your vendors ship you, turns a week of searching into a query.
• Include what answers the internet. Staging sites, old campaign microsites, the admin tool a contractor set up in 2022. An external attack surface scan shows what an attacker sees first.
• Containers don't update themselves. A fixed base image does nothing until you rebuild and redeploy.

3) Rewrite your patch policy around hours#

"We patch within 30 days" was written for a world where turning a fix into an attack took weeks. CISA gave US federal agencies three days for PHP2Shell. Tier your own policy the same way:

Microsoft introduced risk groupings with October's release to help organisations prioritise when 1,411 fixes arrive at once (Analytics Insight). Use them, and roll big updates out in waves, a few machines first, because more fixes also means more breakage.

4) Decide in advance who can switch it off#

Governments, banks and hosting providers took services offline this month because patching couldn't happen fast enough, or because the platform itself was compromised. That is a business decision, and it has to be made before the emergency, not during it. Decide who may take a customer-facing service down at 22:00 on a Sunday without a meeting, have a maintenance page ready, write the customer message now, and rehearse it once. Then do the reverse exercise: what happens to you if a platform you depend on shuts down for a week, as GMO's did, or for good, as Zeabur's will?

5) Put something in front of your public sites#

Cloudflare pushed rules against PHP2Shell to every customer, including free accounts, about nine hours before the flaws were public (The Next Web). A web application firewall or reverse proxy in front of your sites buys you hours when a fix is late. It is never the fix: attackers rework their payloads to get around the rules, as PeopleSoft users learned earlier this year. If you use managed hosting, ask your host when they patched PHP2Shell. The answer tells you what you are paying for.

6) Treat update channels as attack surface#

Patch security fixes fast, but don't let anything install itself unseen.

• Verify what you install. Pin dependency versions and file hashes in your builds, prefer signed and immutable releases, and roll ordinary updates out in stages. Pinned hashes are why Homebrew users never received OVHcloud's poisoned releases.
• Limit what can push changes to you. Remote management keys like UpdraftCentral's are a skeleton key to every site they connect. Keep an inventory of them, give them the narrowest scope possible, and rotate them on a schedule.
• Watch for change. Alert on new admin accounts, new plugins and new files in web roots. This month's WordPress backdoors produced all three.

7) Revoke, don't just delete#

LiteLLM's key was flagged in May and never revoked. Zeabur's administrator credentials survived its first breach and caused its second. A secret that has leaked is only safe once it has been revoked at the source, not when it has been deleted from a repository or hidden from a dashboard.

• Keep secrets in a secrets manager, not in source code, and prefer short-lived credentials that expire on their own.
• Assume your hosting platform will be breached at some point, and know how to rotate every secret you have stored with it in an afternoon. If you were on Railway, OpenCode or Zeabur this month, that afternoon is today.
• After any incident, rotate everything, not just what you can prove was touched.

8) Treat end-of-life software as an open risk#

PHP 8.1 and older, Node.js 20 and every other unsupported version will keep accumulating bugs that AI can find and nobody will fix. Put upgrades in the budget as risk reduction, not as a technical nice-to-have, and start with PHP 8.2 before it runs out of support at the end of December.

9) Assume an exposed system will be breached, and limit what that costs#

Keep web servers separated from the internal network, give web applications only the credentials they need, and watch for web server processes starting shells or download tools. If a server ran unpatched PHP since 17 October, rotate every secret it could read. Those are the machine identities that turn one breach into many. For the systems you truly can't afford to lose, Clinton's August advice was blunter: isolate them from the network entirely, with air gaps or one-way data links (AGTP).

10) Ask your vendors the same questions#

Anthropic was reached through third-party business software, not through Claude. Ask your SaaS and IT suppliers how fast they patched PHP2Shell and Node2Shell, how they protect their own update channels and signing keys, whether they publish a security contact, and what patch times they commit to, and put the answers in contracts at renewal. Ask your firewall and VPN vendors directly whether their appliances embed PHP. If you sell software or connected products in the EU, note that the Cyber Resilience Act's reporting duty, in force since September, may give you 24 hours to report an actively exploited flaw in your product, including one in a component you bundle.

11) Use the same tools on yourself, and close the easy doors#

If AI can find the bugs in your code, run it before someone else does. AI-assisted review of what you build is now cheap; our guide to securing AI-built apps covers where to start, and vetted security teams can apply to OpenAI's Daybreak programme or Anthropic's expanded Cyber Verification Program for the more capable models. Budget for the part that doesn't scale: OpenAI has a human engineer review every Patch the Planet finding before it reaches a maintainer (SiliconANGLE), because finding is cheap and confirming and fixing are not.

Then close the doors AI doesn't need to find. Ransomware groups walked past multi-factor authentication on VPNs this month, and a broker collected 70,000 credentials partly by guessing passwords. Move staff and remote access to phishing-resistant sign-in (passkeys or FIDO2 security keys) wherever you can, and practise with realistic tests; our post on phishing simulations explains what a useful one looks like.

What to watch over the next six months#

• More "2Shell" names. WordPress core had wp2shell in July (BleepingComputer), Plex, PHP and Node.js followed in October, and every widely used runtime, parser and library is getting the same treatment. Expect emergency releases in clusters.
• The firmware tail. Watch for PHP2Shell fixes from firewall, VPN and storage vendors, and for attacks on the appliances that haven't had one.
• More breach notices from October. Investigations into Railway, Zeabur, GMO and the Japanese wave will keep producing disclosures for months.
• The end of the window. Amodei's six to twelve months from May runs out between now and next spring; Clinton's 18 months runs to the spring of 2028. Watch for openly downloadable models reaching today's restricted capability, because at that point restricting access stops protecting anyone.
• Memory-safe rewrites and AI-built-in security. Both headline October bugs were memory-safety flaws in C code. Rewriting core infrastructure in memory-safe languages, and AI that catches bugs before code ships, are the structural fixes. Both will take years.

Summary#

1. Black October was not one bug. Core runtimes, update channels, cloud platforms, a certificate authority and AI-driven attackers all failed or struck in the same few weeks.
2. AI made finding serious bugs cheap. Flaws that survived 14 years in PHP were found in August, then rediscovered independently in an evening.
3. Exploits now arrive in hours, and sometimes before the fix. CISA gave agencies three days for PHP2Shell.
4. Fixing is the bottleneck. Patch volumes are at record highs, appliances wait on vendors, and old versions get no fix at all.
5. Most breaches were basic failures: keys nobody revoked, credentials nobody rotated, passwords that could be guessed. AI removed the time to fix them, not the need.
6. For individuals: unique passwords in a password manager, passkeys where offered, automatic updates on, a family code word, and never paste a command a website asks you to run.
7. For businesses: ask the board for the basics now, know where you run everything, patch internet-facing flaws the same day, verify your update channels, revoke leaked secrets at the source, and retire end-of-life software.
8. It gets worse before it gets better. Plan on roughly 18 months of this, and spend them on the basics.

If you can't say today which of your systems answer the internet, which suppliers can push code to them, or how fast you could patch them, start there. bluwarden runs a free external attack surface scan, including an AI-assisted review, that shows what an attacker sees first. See what we do, then get in touch - we can help you build the inventory, the patch process and the containment that this new normal needs.

Written on 28 October 2026 from public reporting up to that date. Exploitation of PHP2Shell and Node2Shell is changing daily; our PHP2Shell and Node.js posts carry the patching detail, and our weekly roundups track the rest.